11 KiB
Postboot checkpoint evidence review — 2026-09-11
Codex-9e8r6t /root/release_audit. Read-only review after Gitea issue 1 comments through 348. User instruction 328 remains the applicable WSL/VPN boundary. No source, archive, Git/index, native, WSL, compiler or common-ledger mutation was performed; only this report was written.
Payload integrity passes. Two commit-preparation blockers remain: explicitly include ten ignored logs and preserve the three WSL manifest JSON files from Git newline conversion. No new behavioral or runtime acceptance is inferred.
Verified inventory
| Directory under harness/experiments | Files / bytes | Exact checks passed |
|---|---|---|
| contextual-source-layout-postboot-20260911 | 11 / 100,229 | 10 manifest entries |
| contextual-source-layout-verified-20260911 | 13 / 14,505 | 12 manifest entries |
| contextual-source-reopen-20260911 | 11 / 114,037 | 9 payloads and 6 referenced source files |
| wsl-capacity-20260911 | 10 / 236,804 | 8 manifest entries |
| wsl-postboot-9e8r6t-20260911 | 7 / 186,676 | 3 archive hashes and all 45 ZIP entries, including exact entry sets |
Total: 52 files / 652,251 bytes. Every declared length/SHA256 matched: 42 direct payload/archive checks, 45 uncompressed ZIP entries, and 6 reused source-file references. Manifest/README exclusions are explicit; this is not a claim that every directory file is itself listed as a payload. Layout copy-provenance entries also match their retained original paths. All local Markdown links in these five READMEs resolve.
The archived inputs3 and inputs4 contain exactly the same 238 paths; only source_draft.rs differs, matching the recorded test-only delta. The reopen manifest SHA256 matches its README (f79c1308…c921e39b), and all six preservedAt files exist with the expected bytes. Every one of 282 compression records has exit 0 and identical before/after SHA256; the separate partial cache-compression log remains an interrupted operation.
Exact ignored files requiring explicit inclusion
git ls-files returned no tracked files for these five directories. git check-ignore --no-index identifies the following ten untracked files under the global *.log rule; a normal directory add will omit them. Root must force-add these exact paths or deliberately install equally narrow ignore exceptions:
harness/experiments/contextual-source-layout-postboot-20260911/focused3.log
harness/experiments/contextual-source-layout-verified-20260911/clippy1.log
harness/experiments/contextual-source-layout-verified-20260911/focused4.log
harness/experiments/contextual-source-layout-verified-20260911/gui1.log
harness/experiments/contextual-source-reopen-20260911/machine-reopen-same.log
harness/experiments/contextual-source-reopen-20260911/machine-reopen.log
harness/experiments/contextual-source-reopen-20260911/stderr.log
harness/experiments/contextual-source-reopen-20260911/stdout.log
harness/experiments/wsl-capacity-20260911/binary-compression.log
harness/experiments/wsl-capacity-20260911/cache-compression.log
The zero-byte stdout/stderr files are actual archived payloads and must be included. Conversely, fmt1.log never existed because successful formatting emitted no output; its status and explicit absence record are correct. Do not fabricate that file.
Git byte-preservation gap
git check-attr confirms text: unset for every file in the first four directories. Existing rules correctly preserve their measured bytes. The WSL ZIPs are already binary through *.zip, but the three adjacent manifest JSON files inherit text normalization. Read-only git hash-object --no-filters versus --path proves a real checkout/check-in byte change:
| WSL manifest | Raw Git blob | Filtered Git blob |
|---|---|---|
| preparation-through-1503.manifest.json | 9407113cbe |
2f5b50e318c5f28df5c2fd34b96b77dd6504ebdd |
| service-reset-1505.manifest.json | 3a5a968c30 |
4a456fa0d6f10cb4b5d9e1589fb6697761633c72 |
| setup-through-1457.manifest.json | 1ec0d2807b |
b426ac29b0dfd805c60473cfa97a001f9977b59b |
Add the narrow rule before staging, consistent with the other evidence directories:
harness/experiments/wsl-postboot-9e8r6t-20260911/** -text whitespace=-blank-at-eof,cr-at-eol
This preserves raw evidence manifests; it does not repair a corrupt ZIP or JSON interpretation. ZIP/entry hashes already pass. The WSL README is currently byte-stable even without this rule. After root adds the rule and explicit logs, verify staged blobs match the measured raw bytes; this reviewer did not touch the index.
Claim and reference boundaries
- Layout: focused3 is an actual 25/26 failure before the second reboot; focused2 is the earlier explicit interruption. Corrected focused4 passed 26/26, plus strict Clippy, formatting and matching GUI5657. Only 26 of 679 tests ran. Stage manifests reference their original .local layout; the flat verified archive README correctly redirects to archived inputs4. No broken link or missing manifest found.
- Native reopen: GUI52 Open/SA machine view/Save has both oracle exits 0 and exact six-file identity preservation. It does not establish Machine Redo or GUI5657 layout/recovery/transaction acceptance. Root's new GUI5657 v2 baseline opening is not promoted to a new acceptance result by these records.
- Capacity: 282 binary compressions preserve bytes; deletion was rejected before execution. Partial incremental-cache compression is explicitly incomplete. Capacity recovery alone proves neither Linux setup nor application execution.
- WSL: earlier Ubuntu registration/root-shell success is historical and supported by archived terminal records. Both later VirtioProxy starts timed out before guest execution; networking was therefore untested. The distinct WslService reset failed at OS service access and left the service Running. Downloads are hash-verified preparation, with guest signature checks, installation, builds and runtime still pending on this host. Other Gitea hosts' Linux successes cannot be substituted here. No further WSL attempt is recommended by this review.
Minor wording cleanup, not a payload blocker: the WSL archive README says “Both archives” despite listing three. Change to “All three archives” if root edits that unmanifested README before the checkpoint. The corresponding readiness and native/layout reports otherwise keep the reviewed current/historical scopes clear.
Review complete; no owned process or lease remains. Root owns the two commit-preparation fixes, final index verification, coherent publication and subsequent native acceptance.
Later bounded GUI5657 recovery evidence addition
Root separately authorized exact preservation of the frozen Lifeline initial/recovery/cancellation trial. New harness/experiments/contextual-source-recovery-20260911 contains 27 files / 384,922 bytes, including 24 exact whitelist copies; manifest SHA256 dca343a739d4906170c7650bac88e33664c38e55eeb81d8e1c04881723e523d1, verification SHA256 12a9935a778c75b689a028f19c5a3715c49a90533453abef5e2728ac8b783981. No profile/work/cancelled-copy duplicates, private binaries or later direct-creation runs are included.
Independent frozen-record checks establish complete accepted-baseline, entire workspace and authored behavior equality before/after restore, null restored origin, the four unchanged reserved IDs, and cancelled oracle exit 0 with exactly two byte-identical baseline files. Root's normal-panel Name/Activity/root/footer, maximize/restore, child Escape, temporary Use then parent Cancel, empty Undo and separate Save As observations remain attributed to root. No direct Create, transaction history or Machine result is inferred. The three original .png screenshot filenames contain JPEG payloads; this minor format discrepancy is explicitly recorded without altering bytes.
Only the new directory received its authorized narrow -text attribute rule. Its five ignored logs require explicit inclusion: lifeline/runs/initial/{stdout,stderr}.log, lifeline/runs/recovery/{stdout,stderr}.log, and lifeline/cancelled-check-1.log. All original directories remain untouched. Root owns the separate native report/ledgers and commit; a later authorized immutable full-test run is separate from this archive's native-evidence scope.
Later authorized full immutable test run — terminal pass
After the recovery archive was frozen, root authorized one actual full desktop run. The designated executable and runtime hashes were verified first; --list exited 0 with exactly 679 unique tests. The unchanged executable 75AB0E151D85473631D5A145527F3F6B9768A3CD61CE66A0603A574E09557017 then ran once with --test-threads=1, ordinary Windows/Rust stack defaults (RUST_MIN_STACK absent), and isolated temporary/profile directories. No Cargo, rebuild, source edit, UI automation or WSL action occurred.
Terminal result at 15:47:53 UTC: 679 passed, 0 failed, 0 ignored, 0 measured, 0 filtered out; exit 0. The test harness reports 576.67 seconds and the wrapper 576.782 seconds. Separate stderr is empty; executable SHA256 is unchanged after completion. The test lease was released and the wrapper session completed.
The exact raw stdout/stderr, inventory, admission, terminal status and executed helper are preserved in new harness/experiments/contextual-source-layout-full-20260911: 10 files / 159,445 bytes; manifest SHA256 d6a3f1cf6b20df18f91be676a6f9f3dec3603faf57dfb64751cf3292683cce57, terminal-result SHA256 a87d2634fe8be05e7de387346a43056db150f1846ac54a18d02650fe81b9c80d. Raw copies and full archive inventory passed byte readback. No binaries, profiles or output-model duplicates were archived.
This is later evidence that supersedes the earlier full-suite-not-run limitation for this exact artifact. Prior frozen archives were not rewritten. Root must preserve the new directory with its own narrow -text rule and include the four ignored logs (inventory.stdout.log, inventory.stderr.log, full.stdout.log, full.stderr.log). This worker added no further attribute rule beyond the explicitly authorized recovery directory. Direct native transactions/history/Machine, other revisions/binaries and all Linux acceptance remain separate.
Root commit preparation completed
At 16:04:02 UTC, the explicit staged set contains 178 paths: 14 source/ledger/report/attribute files and 164 evidence files across nine directories. All 33 raw logs are included. Git staged blobs for all 164 evidence files and the corrected source_draft.rs match their working bytes exactly; all 238 frozen build inputs still match inputs4. The earlier staging helper stopped at whitespace checking before writing its success receipt. Narrow evidence-only whitespace attributes now preserve authored blank lines, the original launch helper's final blank line and compact.exe's raw CR-CR-LF output without editing any payload. The final staged whitespace check passes.
The two review blockers above are resolved. Direct Lifeline Create/Undo/Redo and Machine Create/Undo/Redo/fresh-process reopen have since passed; their independent byte/oracle records are in the separate lifeline-v2 and machine-v2 archives and the v2 native report. Linux work is paused by the user's latest instruction until the user reports the networking issue resolved.